Newly discovered Linux vulnerabilities, identified as CVE-2025-6018, CVE-2025-6019, and CVE-2025-6020, threaten major distributions like Ubuntu, Debian, Fedora, and openSUSE Leap 15. Uncovered by the Qualys Threat Research Unit (TRU), these local privilege escalation (LPE) flaws allow attackers to gain full root access, risking data breaches and system compromise.

What Are These Linux Vulnerabilities?

CVE-2025-6018: PAM Misconfiguration

This flaw in openSUSE Leap 15’s Pluggable Authentication Modules (PAM) lets unprivileged users gain “allow_active” status, granting unauthorized Polkit actions. By treating SSH sessions as local, attackers can escalate privileges, paving the way for deeper exploits.

CVE-2025-6019: Udisks Daemon Flaw

Exploiting libblockdev via the udisks daemon—a default component in most Linux distributions—this vulnerability allows attackers with “allow_active” status to achieve root privileges. Qualys TRU’s proof-of-concept exploits confirmed rapid root access on Ubuntu, Debian, and Fedora.

CVE-2025-6020: PAM Namespace Issue

A path traversal vulnerability (CVSS: 7.8) in Linux PAM (up to 1.7.0) enables symlink attacks and race conditions in pam_namespace. Fixed in Linux PAM 1.7.1, it poses a root escalation risk if unpatched.

Chained together, these flaws create a dangerous “local-to-root” path, enabling data theft, ransomware, and backdoor implantation.

Why These Flaws Matter

With udisks installed by default, most Linux systems are vulnerable. As Qualys TRU’s Saeed Abbasi noted, “The exploit’s simplicity and udisks’ ubiquity make this a universal threat.” Root access allows attackers to cause operational downtime or lateral movement in networks, threatening enterprises and individuals.

Protect against these Linux security flaws with these steps:

• Patch Immediately: Update to Linux PAM 1.7.1, patched libblockdev, and udisks. Check Ubuntu’s Security Notices or Fedora’s Updates.
• Disable PAM Namespace: Mitigate CVE-2025-6020 by disabling pam_namespace or securing namespace.init.
• Monitor Systems: Use threat intelligence tools to detect exploit attempts.
• Limit Access: Restrict privileges to minimize lateral movement risks.